verzia 2.82, 2011/11/18 23:26:18 |
verzia 2.84, 2011/11/18 23:58:33 |
|
|
# Licensed under terms of GNU General Public License. |
# Licensed under terms of GNU General Public License. |
# All rights reserved. |
# All rights reserved. |
# |
# |
# $Platon: scripts/shell/firewall/fw-universal.sh,v 2.81 2011-10-03 17:42:56 nepto Exp $ |
# $Platon: scripts/shell/firewall/fw-universal.sh,v 2.83 2011-11-18 23:49:00 rajo Exp $ |
# |
# |
# Changelog: |
# Changelog: |
# 2003-10-24 - created |
# 2003-10-24 - created |
|
|
if [ ! -z "$ALL_DROP_INPUT_TCP" ]; then |
if [ ! -z "$ALL_DROP_INPUT_TCP" ]; then |
print_info -en "Drop ALL INPUT TCP connections on ports:" |
print_info -en "Drop ALL INPUT TCP connections on ports:" |
for port in $ALL_DROP_INPUT_TCP; do |
for port in $ALL_DROP_INPUT_TCP; do |
|
echo $port | grep -q , |
|
multiport="$?"; |
|
if [ "$multiport" -eq 0 ]; then |
|
port_rule="--match multiport --dports $port" |
|
else |
|
port_rule="--dport $port" |
|
fi |
for riface in $REAL_INTERFACES; do |
for riface in $REAL_INTERFACES; do |
print_info -en " $port($riface)" |
print_info -en " $port($riface)" |
$IPTABLES -A INPUT -i $riface -p TCP --dport $port -j DROP |
$IPTABLES -A INPUT -i $riface -p TCP $port_rule -j DROP |
done |
done |
done |
done |
print_info " done." |
print_info " done." |
|
|
if [ ! -z "$ALL_DROP_INPUT_UDP" ]; then |
if [ ! -z "$ALL_DROP_INPUT_UDP" ]; then |
print_info -en "Drop ALL INPUT UDP connections on ports:" |
print_info -en "Drop ALL INPUT UDP connections on ports:" |
for port in $ALL_DROP_INPUT_UDP; do |
for port in $ALL_DROP_INPUT_UDP; do |
|
echo $port | grep -q , |
|
multiport="$?"; |
|
if [ "$multiport" -eq 0 ]; then |
|
port_rule="--match multiport --dports $port" |
|
else |
|
port_rule="--dport $port" |
|
fi |
for riface in $REAL_INTERFACES; do |
for riface in $REAL_INTERFACES; do |
print_info -en " $port($riface)" |
print_info -en " $port($riface)" |
$IPTABLES -A INPUT -i $riface -p UDP --dport $port -j DROP |
$IPTABLES -A INPUT -i $riface -p UDP $port_rule -j DROP |
done |
done |
done |
done |
print_info " done." |
print_info " done." |
|
|
if [ ! -z "$REAL_DROP_INPUT_TCP" ]; then |
if [ ! -z "$REAL_DROP_INPUT_TCP" ]; then |
print_info -en "Drop REAL all INPUT TCP connections for ALL interfaces on ports:" |
print_info -en "Drop REAL all INPUT TCP connections for ALL interfaces on ports:" |
for port in $REAL_DROP_INPUT_TCP; do |
for port in $REAL_DROP_INPUT_TCP; do |
|
echo $port | grep -q , |
|
multiport="$?"; |
|
if [ "$multiport" -eq 0 ]; then |
|
port_rule="--match multiport --dports $port" |
|
else |
|
port_rule="--dport $port" |
|
fi |
print_info -en " $port(ALL)" |
print_info -en " $port(ALL)" |
$IPTABLES -A INPUT -p TCP --dport $port -j DROP |
$IPTABLES -A INPUT -p TCP $port_rule -j DROP |
done |
done |
print_info " done." |
print_info " done." |
fi |
fi |
if [ ! -z "$REAL_DROP_INPUT_UDP" ]; then |
if [ ! -z "$REAL_DROP_INPUT_UDP" ]; then |
print_info -en "Drop REAL all INPUT UDP connections for ALL interfaces on ports:" |
print_info -en "Drop REAL all INPUT UDP connections for ALL interfaces on ports:" |
for port in $REAL_DROP_INPUT_UDP; do |
for port in $REAL_DROP_INPUT_UDP; do |
|
echo $port | grep -q , |
|
multiport="$?"; |
|
if [ "$multiport" -eq 0 ]; then |
|
port_rule="--match multiport --dports $port" |
|
else |
|
port_rule="--dport $port" |
|
fi |
print_info -en " $port(ALL)" |
print_info -en " $port(ALL)" |
$IPTABLES -A INPUT -p UDP --dport $port -j DROP |
$IPTABLES -A INPUT -p UDP $port_rule -j DROP |
done |
done |
print_info " done." |
print_info " done." |
fi |
fi |
|
|
riface="IFname_$iface"; |
riface="IFname_$iface"; |
print_info -en " $port($iface)"`[ ! -z $src_ip ] && echo "[$src_ip]"` |
print_info -en " $port($iface)"`[ ! -z $src_ip ] && echo "[$src_ip]"` |
IPS="IP_$iface"; |
IPS="IP_$iface"; |
if [ "$port" -eq 67 ]; then # DHCP requests doesn't have destination IP specified |
if [ "x$port" = "x67" ]; then # DHCP requests doesn't have destination IP specified |
$IPTABLES -A INPUT -i ${!riface} -p UDP --dport $port -j ACCEPT |
$IPTABLES -A INPUT -i ${!riface} -p UDP --dport $port -j ACCEPT |
else |
else |
for ip in ${!IPS}; do |
for ip in ${!IPS}; do |
Riadok 1099 allow_input() |
|
Riadok 1127 allow_input() |
|
print_info -en " $port"`[ ! -z $src_ip ] && echo "[$src_ip]"` |
print_info -en " $port"`[ ! -z $src_ip ] && echo "[$src_ip]"` |
#$IPTABLES -A INPUT -i $iface -d ${!INET_IP} -p UDP --dport $port -j ACCEPT |
#$IPTABLES -A INPUT -i $iface -d ${!INET_IP} -p UDP --dport $port -j ACCEPT |
#$IPTABLES -A INPUT -i $iface --source 192.168.1.0/16 -p UDP --dport $port -j ACCEPT |
#$IPTABLES -A INPUT -i $iface --source 192.168.1.0/16 -p UDP --dport $port -j ACCEPT |
if [ "$port" -eq 67 ]; then # DHCP requests doesn't have destination IP specified |
if [ "x$port" = "x67" ]; then # DHCP requests doesn't have destination IP specified |
$IPTABLES -A INPUT -i ${!riface} -p UDP --dport $port -j ACCEPT |
$IPTABLES -A INPUT -i ${!riface} -p UDP --dport $port -j ACCEPT |
else |
else |
for ip in ${!IPS}; do |
for ip in ${!IPS}; do |